Read the source.

The web is more honest than it looks. Before any clever attack, a professional simply reads the page.

Open portal.html in a browser (or a text editor) and look past what's rendered. The developers left something in the source that visitors were never meant to notice.